Skip to content
  1. Oct 12, 2017
  2. Oct 10, 2017
    • Ladi Prosek's avatar
      KVM: MMU: always terminate page walks at level 1 · 829ee279
      Ladi Prosek authored
      is_last_gpte() is not equivalent to the pseudo-code given in commit
      6bb69c9b ("KVM: MMU: simplify last_pte_bitmap") because an incorrect
      value of last_nonleaf_level may override the result even if level == 1.
      
      It is critical for is_last_gpte() to return true on level == 1 to
      terminate page walks. Otherwise memory corruption may occur as level
      is used as an index to various data structures throughout the page
      walking code.  Even though the actual bug would be wherever the MMU is
      initialized (as in the previous patch), be defensive and ensure here
      that is_last_gpte() returns the correct value.
      
      This patch is also enough to fix CVE-2017-12188.
      
      Fixes: 6bb69c9b
      
      
      Cc: stable@vger.kernel.org
      Cc: Andy Honig <ahonig@google.com>
      Signed-off-by: default avatarLadi Prosek <lprosek@redhat.com>
      [Panic if walk_addr_generic gets an incorrect level; this is a serious
       bug and it's not worth a WARN_ON where the recovery path might hide
       further exploitable issues; suggested by Andrew Honig. - Paolo]
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      829ee279
    • Ladi Prosek's avatar
      KVM: nVMX: update last_nonleaf_level when initializing nested EPT · fd19d3b4
      Ladi Prosek authored
      The function updates context->root_level but didn't call
      update_last_nonleaf_level so the previous and potentially wrong value
      was used for page walks.  For example, a zero value of last_nonleaf_level
      would allow a potential out-of-bounds access in arch/x86/mmu/paging_tmpl.h's
      walk_addr_generic function (CVE-2017-12188).
      
      Fixes: 155a97a3
      
      
      Signed-off-by: default avatarLadi Prosek <lprosek@redhat.com>
      Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
      fd19d3b4
  3. Oct 09, 2017
  4. Oct 08, 2017
  5. Oct 07, 2017
    • Linus Torvalds's avatar
      Merge tag 'hwmon-for-linus-v4.14-rc4' of... · 1c86f2e4
      Linus Torvalds authored
      Merge tag 'hwmon-for-linus-v4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
      
      Pull hwmon fix from Guenter Roeck:
       "Fix up error path in xgene driver"
      
      * tag 'hwmon-for-linus-v4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
        hwmon: (xgene) Fix up error handling path mixup in 'xgene_hwmon_probe()'
      1c86f2e4
    • Linus Torvalds's avatar
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · dbeb1a8f
      Linus Torvalds authored
      Pull clk fixes from Stephen Boyd:
      
       - build fix to export the clk_bulk_prepare() symbol
      
       - suspend fix for Samsung Exynos SoCs where we need to keep clks on
         across suspend
      
       - two critical clk markings for clks that shouldn't ever turn off on
         Rockchip SoCs
      
       - a fix for a copy-paste mistake on Rockchip rk3128 causing some clks
         to touch the same bit and trample over one another
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: samsung: exynos4: Enable VPLL and EPLL clocks for suspend/resume cycle
        clk: Export clk_bulk_prepare()
        clk: rockchip: add sclk_timer5 as critical clock on rk3128
        clk: rockchip: fix up rk3128 pvtm and mipi_24m gate regs error
        clk: rockchip: add pclk_pmu as critical clock on rk3128
      dbeb1a8f
    • Linus Torvalds's avatar
      Merge tag 'arc-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc · ed0f72f4
      Linus Torvalds authored
      Pull ARC udpates from Vineet Gupta:
      
       - updates for various platforms
      
       - boot log updates for upcoming HS48 family of cores (dual issue)
      
      * tag 'arc-4.14-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
        ARC: [plat-hsdk]: Add reset controller node to manage ethernet reset
        ARC: [plat-hsdk]: Temporary fix to set CPU frequency to 1GHz
        ARC: fix allnoconfig build warning
        ARCv2: boot log: identify HS48 cores (dual issue)
        ARC: boot log: decontaminate ARCv2 ISA_CONFIG register
        arc: remove redundant UTS_MACHINE define in arch/arc/Makefile
        ARC: [plat-eznps] Update platform maintainer as Noam left
        ARC: [plat-hsdk] use actual clk driver to manage cpu clk
        ARC: [*defconfig] Reenable soft lock-up detector
        ARC: [plat-axs10x] sdio: Temporary fix of sdio ciu frequency
        ARC: [plat-hsdk] sdio: Temporary fix of sdio ciu frequency
        ARC: [plat-axs103] Add temporary quirk to reset ethernet IP
      ed0f72f4
    • Linus Torvalds's avatar
      Merge tag 'xfs-4.14-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux · eab26ad1
      Linus Torvalds authored
      Pull xfs fixes from Darrick Wong:
      
       - fix a race between overlapping copy on write aio
      
       - fix cow fork swapping when we defragment reflinked files
      
      * tag 'xfs-4.14-fixes-4' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
        xfs: handle racy AIO in xfs_reflink_end_cow
        xfs: always swap the cow forks when swapping extents
      eab26ad1
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.dk/linux-block · 17d084c8
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A collection of fixes for this series. This contains:
      
         - NVMe pull request from Christoph, one uuid attribute fix, and one
           fix for the controller memory buffer address for remapped BARs.
      
         - use-after-free fix for bsg, from Benjamin Block.
      
         - bcache race/use-after-free fix for a list traversal, fixing a
           regression in this merge window. From Coly Li.
      
         - null_blk change configfs dependency change from a 'depends' to a
           'select'. This is a change from this merge window as well. From me.
      
         - nbd signal fix from Josef, fixing a regression introduced with the
           status code changes.
      
         - nbd MAINTAINERS mailing list entry update.
      
         - blk-throttle stall fix from Joseph Qi.
      
         - blk-mq-debugfs fix from Omar, fixing an issue where we don't
           register the IO scheduler debugfs directory, if the driver is
           loaded with it. Only shows up if you switch through the sysfs
           interface"
      
      * 'for-linus' of git://git.kernel.dk/linux-block:
        bsg-lib: fix use-after-free under memory-pressure
        nvme-pci: Use PCI bus address for data/queues in CMB
        blk-mq-debugfs: fix device sched directory for default scheduler
        null_blk: change configfs dependency to select
        blk-throttle: fix possible io stall when upgrade to max
        MAINTAINERS: update list for NBD
        nbd: fix -ERESTARTSYS handling
        nvme: fix visibility of "uuid" ns attribute
        bcache: use llist_for_each_entry_safe() in __closure_wake_up()
      17d084c8
    • Linus Torvalds's avatar
      Merge tag 'pci-v4.14-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci · 80cf1f8c
      Linus Torvalds authored
      Pull PCI fixes from Bjorn Helgaas:
       "Fix legacy IDE probe issues exposed by recent PCI core IRQ mapping
        changes (Bartlomiej Zolnierkiewicz, Lorenzo Pieralisi)"
      
      * tag 'pci-v4.14-fixes-4' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
        ide: fix IRQ assignment for PCI bus order probing
        ide: pci: free PCI BARs on initialization failure
        ide: free hwif->portdev on hwif_init() failure
      80cf1f8c